Yes, I'm aware this opens them up to all kinds of liability, but corporate liability is worth so much less than data that could save human lives. I'm of the opinion that corporate retention policies are specifically encouraging companies to cover up mistakes rather than fixing them. It feels to me like, if we required companies to retain data for years rather than days, and then rewarded companies that use that data to fully cooperate with investigators, swiftly admit fault, and take corrective action when the screw up, with lower fines and penalties, that that would trump the perceived "danger" of retaining data for too long.
The fact that companies are actively encouraged to delete evidence of wrongdoing so that when a situation emerges where that data would be useful, the company can just shift blame on an asinine written policy is completely nuts to me, and shows that we've totally lost the f**ing plot when it comes to actually encouraging better safety practices.